配置管理：GitOps与Infrastructure as Code

# infra/main.tf - Terraform 主入口
# 使用模块化组织基础设施定义
 
terraform {
  required_version = ">= 1.6"
 
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.25"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.12"
    }
  }
 
  # 远程状态存储（S3 + DynamoDB 锁）
  backend "s3" {
    bucket         = "terraform-state-prod"
    key            = "infra/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/xxx"
  }
}
 
# 区域和账户变量
variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-east-1"
}
 
variable "environment" {
  description = "Environment name"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}
 
variable "cluster_name" {
  description = "EKS cluster name"
  type        = string
  default     = "main"
}
 
provider "aws" {
  region = var.aws_region
 
  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "terraform"
      Project     = "platform"
    }
  }
}
 
# VPC 模块
module "vpc" {
  source = "./modules/vpc"
 
  environment   = var.environment
  vpc_cidr      = "10.0.0.0/16"
  azs           = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"]
 
  # 生产环境启用 NAT Gateway 高可用
  enable_nat_gateway     = true
  single_nat_gateway     = var.environment != "production"
  one_nat_gateway_per_az = var.environment == "production"
}
 
# EKS 模块
module "eks" {
  source = "./modules/eks"
 
  environment  = var.environment
  cluster_name = "${var.environment}-${var.cluster_name}"
  vpc_id       = module.vpc.vpc_id
  subnet_ids   = module.vpc.private_subnet_ids
 
  cluster_version = "1.29"
 
  # 节点组配置
  node_groups = {
    general = {
      instance_types = ["m6i.large"]
      min_size       = var.environment == "production" ? 3 : 1
      max_size       = var.environment == "production" ? 20 : 5
      desired_size   = var.environment == "production" ? 5 : 2
      labels = {
        role = "general"
      }
    }
    compute = {
      instance_types = ["c6i.xlarge"]
      min_size       = 0
      max_size       = var.environment == "production" ? 50 : 10
      desired_size   = var.environment == "production" ? 3 : 0
      taints = {
        dedicated = {
          key    = "dedicated"
          value  = "compute"
          effect = "NO_SCHEDULE"
        }
      }
    }
  }
 
  # 安全配置
  cluster_encryption_config = {
    provider_key_arn = aws_kms_key.eks.arn
    resources        = ["secrets"]
  }
 
  # 日志配置
  cluster_enabled_log_types = ["api", "audit", "authenticator"]
}
 
# ArgoCD 安装（通过 Helm）
resource "helm_release" "argocd" {
  name             = "argocd"
  repository       = "https://argoproj.github.io/argo-helm"
  chart            = "argo-cd"
  namespace        = "argocd"
  create_namespace = true
  version          = "5.52.0"
 
  values = [
    templatefile("${path.module}/values/argocd.yaml.tpl", {
      environment    = var.environment
      domain         = "argocd.${var.environment}.example.com"
      repo_url       = "https://github.com/org/gitops-config.git"
    })
  ]
 
  depends_on = [module.eks]
}

# infra/modules/vpc/main.tf - VPC 模块定义
 
variable "environment" {
  type = string
}
 
variable "vpc_cidr" {
  type = string
}
 
variable "azs" {
  type = list(string)
}
 
variable "public_subnets" {
  type = list(string)
}
 
variable "private_subnets" {
  type = list(string)
}
 
variable "enable_nat_gateway" {
  type    = bool
  default = false
}
 
variable "single_nat_gateway" {
  type    = bool
  default = true
}
 
variable "one_nat_gateway_per_az" {
  type    = bool
  default = false
}
 
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
 
  tags = {
    Name        = "${var.environment}-vpc"
    Environment = var.environment
  }
}
 
resource "aws_subnet" "public" {
  count = length(var.public_subnets)
 
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnets[count.index]
  availability_zone       = var.azs[count.index]
  map_public_ip_on_launch = true
 
  tags = {
    Name = "${var.environment}-public-${var.azs[count.index]}"
    Tier = "public"
  }
}
 
resource "aws_subnet" "private" {
  count = length(var.private_subnets)
 
  vpc_id            = aws_vpc.main.id
  cidr_block        = var.private_subnets[count.index]
  availability_zone = var.azs[count.index]
 
  tags = {
    Name = "${var.environment}-private-${var.azs[count.index]}"
    Tier = "private"
  }
}
 
# 输出
output "vpc_id" {
  value = aws_vpc.main.id
}
 
output "private_subnet_ids" {
  value = aws_subnet.private[*].id
}
 
output "public_subnet_ids" {
  value = aws_subnet.public[*].id
}

# gitops-config/apps/payment-service.yaml
# ArgoCD Application 定义 - 支付服务
 
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: payment-service
  namespace: argocd
  # 最终izer 确保删除 Application 时同时清理集群资源
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  # 标签用于分组和搜索
  labels:
    team: payments
    tier: backend
    criticality: high
spec:
  # 项目（用于 RBAC 隔离）
  project: payments
 
  # 源配置：从哪个 Git 仓库的哪个路径读取清单
  source:
    repoURL: https://github.com/org/k8s-manifests.git
    targetRevision: main
    path: overlays/production/payment-service
 
    # Helm value 覆盖
    helm:
      valueFiles:
        - values.yaml
        - values-production.yaml
      parameters:
        - name: image.tag
          value: "v2.3.1"
        - name: replicas
          value: "3"
 
  # 目标配置：部署到哪个集群的哪个命名空间
  destination:
    server: https://kubernetes.default.svc
    namespace: payments
 
  # 同步策略
  syncPolicy:
    # 自动同步
    automated:
      prune: true    # 自动删除 Git 中不存在的资源
      selfHeal: true # 自动修复漂移
      allowEmpty: false
 
    # 同步选项
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true
      - ServerSideApply=true
 
    # 重试策略
    retry:
      limit: 3
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m
 
  # 忽略某些字段的漂移检测
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jsonPointers:
        - /spec/replicas  # HPA 控制的副本数不应触发漂移告警
    - group: ""
      kind: Secret
      jsonPointers:
        - /data  # 外部 Secret Manager 注入的值

# gitops-config/appsets/microservices.yaml
# ApplicationSet - 多环境多集群微服务部署
 
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: microservices
  namespace: argocd
spec:
  # 生成器：从 Git 目录结构自动发现应用
  generators:
    # 矩阵生成器：组合集群和应用
    - matrix:
        generators:
          # 集群生成器：从 ArgoCD 注册的集群列表生成
          - clusters:
              selector:
                matchLabels:
                  managed: "true"
              values:
                # 根据集群名称确定环境
                environment: '{{index .metadata.labels "environment"}}'
 
          # Git 目录生成器：从仓库目录结构发现应用
          - git:
              repoURL: https://github.com/org/k8s-manifests.git
              revision: main
              directories:
                - path: "base/*"
                  exclude: true  # 排除 base 目录
                - path: "overlays/production/*"
 
  # 模板：生成 Application 的模板
  template:
    metadata:
      name: '{{path.basename}}-{{values.environment}}'
      labels:
        app: '{{path.basename}}'
        environment: '{{values.environment}}'
    spec:
      project: '{{values.environment}}'
      source:
        repoURL: https://github.com/org/k8s-manifests.git
        targetRevision: main
        path: 'overlays/{{values.environment}}/{{path.basename}}'
        helm:
          valueFiles:
            - values.yaml
            - 'values-{{values.environment}}.yaml'
      destination:
        server: '{{server}}'
        namespace: '{{path.basename}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

# gitops-config/apps/payment-rollout.yaml
# Argo Rollouts - 金丝雀发布策略
 
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: payment-service
  namespace: payments
spec:
  replicas: 10
  strategy:
    canary:
      # 金丝雀发布步骤
      steps:
        # 步骤 1：将 5% 流量导向新版本
        - setWeight: 5
        # 步骤 2：暂停，等待人工确认或自动分析
        - pause:
            duration: 5m
        # 步骤 3：将流量提升到 20%
        - setWeight: 20
        # 步骤 4：运行自动分析
        - analysis:
            templates:
              - templateName: success-rate
            args:
              - name: service-name
                value: payment-service-canary
        # 步骤 5：将流量提升到 50%
        - setWeight: 50
        # 步骤 6：暂停，等待人工确认
        - pause: {}
        # 步骤 7：全量发布
        - setWeight: 100
 
      # 金丝雀服务配置
      canaryService: payment-service-canary
      stableService: payment-service-stable
 
      # 流量管理（Istio）
      trafficRouting:
        istio:
          virtualServices:
            - name: payment-service
              routes:
                - primary
 
  # 工作负载模板
  selector:
    matchLabels:
      app: payment-service
  template:
    metadata:
      labels:
        app: payment-service
    spec:
      containers:
        - name: payment-service
          image: registry.example.com/payment-service:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
 
---
# 自动分析模板：基于 Prometheus 指标判断发布质量
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
  namespace: payments
spec:
  args:
    - name: service-name
  metrics:
    - name: success-rate
      interval: 30s
      count: 5
      successLimit: 3
      failureLimit: 2
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            sum(rate(http_requests_total{service="{{args.service-name}}",status!~"5.."}[1m]))
            /
            sum(rate(http_requests_total{service="{{args.service-name}}"}[1m]))
      # 成功条件：成功率 > 99%
      successCondition: result[0] >= 0.99
      # 失败条件：成功率 < 95%
      failureCondition: result[0] < 0.95

// infra/index.ts - Pulumi 基础设施定义（TypeScript）
 
import * as aws from "@pulumi/aws";
import * as k8s from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";
 
// 配置
const config = new pulumi.Config();
const environment = config.require("environment");
const vpcCidr = config.get("vpcCidr") || "10.0.0.0/16";
 
// 标签策略：所有资源统一标签
const commonTags = {
  Environment: environment,
  ManagedBy: "pulumi",
  Project: "platform",
  Owner: "platform-team",
};
 
// VPC
const vpc = new aws.ec2.Vpc("main", {
  cidrBlock: vpcCidr,
  enableDnsHostnames: true,
  enableDnsSupport: true,
  tags: { ...commonTags, Name: `${environment}-vpc` },
});
 
// 子网
const publicSubnets = ["us-east-1a", "us-east-1b", "us-east-1c"].map(
  (az, i) =>
    new aws.ec2.Subnet(`public-${az}`, {
      vpcId: vpc.id,
      cidrBlock: `10.0.${i + 1}.0/24`,
      availabilityZone: az,
      mapPublicIpOnLaunch: true,
      tags: { ...commonTags, Name: `${environment}-public-${az}`, Tier: "public" },
    })
);
 
const privateSubnets = ["us-east-1a", "us-east-1b", "us-east-1c"].map(
  (az, i) =>
    new aws.ec2.Subnet(`private-${az}`, {
      vpcId: vpc.id,
      cidrBlock: `10.0.${i + 10}.0/24`,
      availabilityZone: az,
      tags: { ...commonTags, Name: `${environment}-private-${az}`, Tier: "private" },
    })
);
 
// EKS 集群
const cluster = new aws.eks.Cluster("main", {
  name: `${environment}-cluster`,
  roleArn: clusterRole.arn,
  version: "1.29",
  vpcConfig: {
    subnetIds: [...publicSubnets.map((s) => s.id), ...privateSubnets.map((s) => s.id)],
    endpointPrivateAccess: true,
    endpointPublicAccess: environment !== "production",
  },
  encryptionConfig: {
    provider: { keyArn: kmsKey.arn },
    resources: ["secrets"],
  },
  tags: commonTags,
}, { dependsOn: [clusterRolePolicyAttachment] });
 
// ArgoCD 安装
const argocdNamespace = new k8s.core.v1.Namespace("argocd", {
  metadata: { name: "argocd" },
}, { provider: k8sProvider });
 
const argocd = new k8s.helm.v3.Release("argocd", {
  name: "argocd",
  chart: "argo-cd",
  repositoryOpts: { repo: "https://argoproj.github.io/argo-helm" },
  version: "5.52.0",
  namespace: "argocd",
  values: {
    server: {
      ingress: {
        enabled: true,
        hosts: [`argocd.${environment}.example.com`],
      },
    },
    configs: {
      repositories: {
        "gitops-config": {
          url: "https://github.com/org/gitops-config.git",
          type: "git",
        },
      },
    },
  },
}, { provider: k8sProvider, dependsOn: [argocdNamespace] });
 
// 导出
export const vpcId = vpc.id;
export const clusterName = cluster.name;
export const argocdEndpoint = pulumi.interpolate`https://argocd.${environment}.example.com`;

# infra/crossplane/provider-config.yaml
# Crossplane AWS Provider 配置
 
apiVersion: aws.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: aws-provider
spec:
  credentials:
    source: Secret
    secretRef:
      namespace: crossplane-system
      name: aws-credentials
      key: credentials
  region: us-east-1
 
---
# infra/crossplane/s3-bucket.yaml
# 使用 Crossplane 定义 S3 Bucket（K8s 原生方式）
 
apiVersion: s3.aws.upbound.io/v1beta1
kind: Bucket
metadata:
  name: platform-artifacts
  annotations:
    crossplane.io/external-name: platform-artifacts-prod
spec:
  forProvider:
    region: us-east-1
    versioning:
      - enabled: true
    serverSideEncryptionConfiguration:
      - rule:
          - applyServerSideEncryptionByDefault:
              - sseAlgorithm: aws:kms
                kmsMasterKeyId: arn:aws:kms:us-east-1:123456789012:key/xxx
    lifecycleRule:
      - id: cleanup-old-versions
        enabled: true
        noncurrentVersionExpiration:
          - days: 30
    tags:
      Environment: production
      ManagedBy: crossplane
  providerConfigRef:
    name: aws-provider
  # 删除策略：保留资源（防止误删）
  deletionPolicy: Orphan

gitops-config/
├── README.md
├── argocd/
│   ├── apps/                    # ArgoCD Application 定义
│   │   ├── payment-service.yaml
│   │   ├── user-service.yaml
│   │   └── frontend.yaml
│   ├── appsets/                 # ApplicationSet 定义
│   │   └── microservices.yaml
│   └── projects/                # ArgoCD Project 定义
│       ├── payments.yaml
│       └── frontend.yaml
├── base/                        # Kustomize Base（共享配置）
│   ├── payment-service/
│   │   ├── kustomization.yaml
│   │   ├── deployment.yaml
│   │   └── service.yaml
│   └── user-service/
│       ├── kustomization.yaml
│       ├── deployment.yaml
│       └── service.yaml
├── overlays/                    # Kustomize Overlays（环境差异）
│   ├── development/
│   │   ├── kustomization.yaml
│   │   └── patches/
│   ├── staging/
│   │   ├── kustomization.yaml
│   │   └── patches/
│   └── production/
│       ├── kustomization.yaml
│       └── patches/
├── infra/                       # 基础设施定义
│   ├── terraform/
│   │   ├── main.tf
│   │   ├── modules/
│   │   └── environments/
│   └── crossplane/
│       ├── provider-config.yaml
│       └── resources/
└── scripts/                     # 辅助脚本
    ├── validate-manifests.sh
    └── diff-apply.sh

# External Secrets Operator 示例
# 从 AWS Secrets Manager 同步 Secret 到 Kubernetes
 
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secrets-manager
  namespace: payments
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa
 
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: payment-db-credentials
  namespace: payments
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: payment-db-credentials
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: payments/database
        property: username
    - secretKey: password
      remoteRef:
        key: payments/database
        property: password

# ArgoCD 漂移检测配置
# argocd-cm ConfigMap
 
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # 漂移检测间隔（默认 300 秒）
  timeout.reconciliation: "300s"
 
  # 资源级别的忽略差异配置
  resource.customizations.ignoreDifferences.apps_Deployment: |
    jsonPointers:
      - /spec/replicas
      - /spec/template/metadata/annotations/kubectl.kubernetes.io~1restartedAt
 
  # 全局忽略差异
  resource.ignoreDifferences: |
    all:
      jsonPointers:
        - /metadata/annotations/kubectl.kubernetes.io~1last-applied-configuration

#!/bin/bash
# measure-gitops-metrics.sh
# 采集 GitOps 效果度量指标
 
ARGOCD_SERVER="${1:-argocd.example.com}"
ARGOCD_TOKEN="${ARGOCD_TOKEN:?请设置 ARGOCD_TOKEN 环境变量}"
 
echo "=== GitOps 效果度量报告 ==="
echo ""
 
# 1. GitOps 覆盖率
echo "--- 1. GitOps 覆盖率 ---"
APPS=$(curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
  "https://${ARGOCD_SERVER}/api/v1/applications" | \
  jq '.items | length')
HEALTHY=$(curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
  "https://${ARGOCD_SERVER}/api/v1/applications" | \
  jq '[.items[] | select(.status.health.status == "Healthy")] | length')
SYNCED=$(curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
  "https://${ARGOCD_SERVER}/api/v1/applications" | \
  jq '[.items[] | select(.status.sync.status == "Synced")] | length')
 
echo "  总应用数: $APPS"
echo "  健康应用数: $HEALTHY"
echo "  同步应用数: $SYNCED"
if [ "$APPS" -gt 0 ]; then
  HEALTH_RATE=$(echo "scale=2; $HEALTHY * 100 / $APPS" | bc)
  SYNC_RATE=$(echo "scale=2; $SYNCED * 100 / $APPS" | bc)
  echo "  健康率: ${HEALTH_RATE}%"
  echo "  同步率: ${SYNC_RATE}%"
fi
 
# 2. 漂移检测统计
echo ""
echo "--- 2. 漂移检测统计 ---"
OUT_OF_SYNC=$(curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
  "https://${ARGOCD_SERVER}/api/v1/applications" | \
  jq '[.items[] | select(.status.sync.status == "OutOfSync")] | length')
echo "  漂移应用数: $OUT_OF_SYNC"
 
# 列出漂移的应用详情
if [ "$OUT_OF_SYNC" -gt 0 ]; then
  echo "  漂移应用列表:"
  curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
    "https://${ARGOCD_SERVER}/api/v1/applications" | \
    jq -r '.items[] | select(.status.sync.status == "OutOfSync") |
      "    - \(.metadata.name) (\(.status.sync.status)): \(.status.sync.comparedTo.source.targetRevision)"'
fi
 
# 3. 变更前置时间
echo ""
echo "--- 3. 最近同步操作 ---"
curl -s -H "Authorization: Bearer $ARGOCD_TOKEN" \
  "https://${ARGOCD_SERVER}/api/v1/applications?fields=items.metadata.name,items.status.operationState" | \
  jq -r '.items[] | select(.status.operationState != null) |
    "\(.metadata.name): started=\(.status.operationState.startedAt) finished=\(.status.operationState.finishedAt // "running") phase=\(.status.operationState.phase)"' | \
  head -10
 
# 4. Terraform 状态分析
echo ""
echo "--- 4. IaC 覆盖率 ---"
if command -v terraform &> /dev/null; then
  RESOURCE_COUNT=$(terraform state list 2>/dev/null | wc -l || echo "N/A")
  echo "  Terraform 管理的资源数: $RESOURCE_COUNT"
else
  echo "  Terraform 未安装，跳过 IaC 覆盖率统计"
fi
 
echo ""
echo "=== 报告结束 ==="